xref: /optee_os/core/arch/arm/kernel/entry_a32.S (revision 89da7ffe58b51e694eef722a0db34b19531ef770)
1/* SPDX-License-Identifier: BSD-2-Clause */
2/*
3 * Copyright (c) 2014, Linaro Limited
4 * Copyright (c) 2021-2023, Arm Limited
5 */
6
7#include <arm.h>
8#include <arm32_macros.S>
9#include <asm.S>
10#include <generated/asm-defines.h>
11#include <keep.h>
12#include <kernel/asan.h>
13#include <kernel/cache_helpers.h>
14#include <kernel/thread.h>
15#include <kernel/thread_private.h>
16#include <mm/core_mmu.h>
17#include <platform_config.h>
18#include <sm/optee_smc.h>
19#include <sm/teesmc_opteed.h>
20#include <sm/teesmc_opteed_macros.h>
21
22.arch_extension sec
23
24.section .data
25.balign 4
26
27#ifdef CFG_BOOT_SYNC_CPU
28.equ SEM_CPU_READY, 1
29#endif
30
31#ifdef CFG_PL310
32.section .rodata.init
33panic_boot_file:
34	.asciz __FILE__
35
36/*
37 * void assert_flat_mapped_range(uint32_t vaddr, uint32_t line)
38 */
39LOCAL_FUNC __assert_flat_mapped_range , :
40UNWIND(	.cantunwind)
41	push	{ r4-r6, lr }
42	mov	r4, r0
43	mov	r5, r1
44	bl	cpu_mmu_enabled
45	cmp	r0, #0
46	beq	1f
47	mov	r0, r4
48	bl	virt_to_phys
49	cmp	r0, r4
50	beq	1f
51	/*
52	 * this must be compliant with the panic generic routine:
53	 * __do_panic(__FILE__, __LINE__, __func__, str)
54	 */
55	ldr	r0, =panic_boot_file
56	mov	r1, r5
57	mov	r2, #0
58	mov	r3, #0
59	bl	__do_panic
60	b	.		/* should NOT return */
611:	pop	{ r4-r6, pc }
62END_FUNC __assert_flat_mapped_range
63
64	/* panic if mmu is enable and vaddr != paddr (scratch lr) */
65	.macro assert_flat_mapped_range va, line
66		ldr	r0, \va
67		ldr	r1, =\line
68		bl	__assert_flat_mapped_range
69	.endm
70#endif /* CFG_PL310 */
71
72WEAK_FUNC plat_cpu_reset_early , :
73	bx	lr
74END_FUNC plat_cpu_reset_early
75DECLARE_KEEP_PAGER plat_cpu_reset_early
76
77	.section .identity_map, "ax"
78	.align 5
79LOCAL_FUNC reset_vect_table , : , .identity_map
80	b	.
81	b	.	/* Undef */
82	b	.	/* Syscall */
83	b	.	/* Prefetch abort */
84	b	.	/* Data abort */
85	b	.	/* Reserved */
86	b	.	/* IRQ */
87	b	.	/* FIQ */
88END_FUNC reset_vect_table
89
90	.macro cpu_is_ready
91#ifdef CFG_BOOT_SYNC_CPU
92	bl	__get_core_pos
93	lsl	r0, r0, #2
94	ldr	r1,=sem_cpu_sync
95	ldr	r2, =SEM_CPU_READY
96	str	r2, [r1, r0]
97	dsb
98	sev
99#endif
100	.endm
101
102	.macro wait_primary
103#ifdef CFG_BOOT_SYNC_CPU
104	ldr	r0, =sem_cpu_sync
105	mov	r2, #SEM_CPU_READY
106	sev
1071:
108	ldr	r1, [r0]
109	cmp	r1, r2
110	wfene
111	bne	1b
112#endif
113	.endm
114
115	.macro wait_secondary
116#ifdef CFG_BOOT_SYNC_CPU
117	ldr	r0, =sem_cpu_sync
118	mov	r3, #CFG_TEE_CORE_NB_CORE
119	mov	r2, #SEM_CPU_READY
120	sev
1211:
122	subs	r3, r3, #1
123	beq	3f
124	add	r0, r0, #4
1252:
126	ldr	r1, [r0]
127	cmp	r1, r2
128	wfene
129	bne	2b
130	b	1b
1313:
132#endif
133	.endm
134
135	/*
136	 * set_sctlr : Setup some core configuration in CP15 SCTLR
137	 *
138	 * Setup required by current implementation of the OP-TEE core:
139	 * - Disable data and instruction cache.
140	 * - MMU is expected off and exceptions trapped in ARM mode.
141	 * - Enable or disable alignment checks upon platform configuration.
142	 * - Optionally enable write-implies-execute-never.
143	 * - Optionally enable round robin strategy for cache replacement.
144	 *
145	 * Clobbers r0.
146	 */
147	.macro set_sctlr
148		read_sctlr r0
149		bic	r0, r0, #(SCTLR_M | SCTLR_C)
150		bic	r0, r0, #SCTLR_I
151		bic	r0, r0, #SCTLR_TE
152		orr	r0, r0, #SCTLR_SPAN
153#if defined(CFG_SCTLR_ALIGNMENT_CHECK)
154		orr	r0, r0, #SCTLR_A
155#else
156		bic	r0, r0, #SCTLR_A
157#endif
158#if defined(CFG_HWSUPP_MEM_PERM_WXN) && defined(CFG_CORE_RWDATA_NOEXEC)
159		orr	r0, r0, #(SCTLR_WXN | SCTLR_UWXN)
160#endif
161#if defined(CFG_ENABLE_SCTLR_RR)
162		orr	r0, r0, #SCTLR_RR
163#endif
164		write_sctlr r0
165	.endm
166
167	.macro maybe_init_spectre_workaround
168#if !defined(CFG_WITH_ARM_TRUSTED_FW) && \
169    (defined(CFG_CORE_WORKAROUND_SPECTRE_BP) || \
170     defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC))
171	read_midr r0
172	ubfx	r1, r0, #MIDR_IMPLEMENTER_SHIFT, #MIDR_IMPLEMENTER_WIDTH
173	cmp	r1, #MIDR_IMPLEMENTER_ARM
174	bne	1f
175	ubfx	r1, r0, #MIDR_PRIMARY_PART_NUM_SHIFT, \
176			#MIDR_PRIMARY_PART_NUM_WIDTH
177
178	movw	r2, #CORTEX_A8_PART_NUM
179	cmp	r1, r2
180	moveq	r2, #ACTLR_CA8_ENABLE_INVALIDATE_BTB
181	beq	2f
182
183	movw	r2, #CORTEX_A15_PART_NUM
184	cmp	r1, r2
185	moveq	r2, #ACTLR_CA15_ENABLE_INVALIDATE_BTB
186	bne	1f	/* Skip it for all other CPUs */
1872:
188	read_actlr r0
189	orr	r0, r0, r2
190	write_actlr r0
191	isb
1921:
193#endif
194	.endm
195
196FUNC _start , :
197UNWIND(	.cantunwind)
198	/*
199	 * Temporary copy of boot argument registers, will be passed to
200	 * boot_save_args() further down.
201	 */
202	mov	r4, r0
203	mov	r5, r1
204	mov	r6, r2
205	mov	r7, r3
206	mov	r8, lr
207
208	/*
209	 * 32bit entry is expected to execute Supervisor mode,
210	 * some bootloader may enter in Supervisor or Monitor
211	 */
212	cps	#CPSR_MODE_SVC
213
214	/* Early ARM secure MP specific configuration */
215	bl	plat_cpu_reset_early
216	maybe_init_spectre_workaround
217
218	set_sctlr
219	isb
220
221	ldr	r0, =reset_vect_table
222	write_vbar r0
223
224#if defined(CFG_WITH_ARM_TRUSTED_FW)
225	b	reset_primary
226#else
227	bl	__get_core_pos
228	cmp	r0, #0
229	beq	reset_primary
230	b	reset_secondary
231#endif
232END_FUNC _start
233DECLARE_KEEP_INIT _start
234
235	/*
236	 * Setup sp to point to the top of the tmp stack for the current CPU:
237	 * sp is assigned:
238	 *   stack_tmp + (cpu_id + 1) * stack_tmp_stride - STACK_TMP_GUARD
239	 */
240	.macro set_sp
241		bl	__get_core_pos
242		cmp	r0, #CFG_TEE_CORE_NB_CORE
243		/* Unsupported CPU, park it before it breaks something */
244		bge	unhandled_cpu
245		add	r0, r0, #1
246
247		/* r2 = stack_tmp - STACK_TMP_GUARD */
248		adr	r3, stack_tmp_rel
249		ldr	r2, [r3]
250		add	r2, r2, r3
251
252		/*
253		 * stack_tmp_stride and stack_tmp_stride_rel are the
254		 * equivalent of:
255		 * extern const u32 stack_tmp_stride;
256		 * u32 stack_tmp_stride_rel = (u32)&stack_tmp_stride -
257		 *			      (u32)&stack_tmp_stride_rel
258		 *
259		 * To load the value of stack_tmp_stride we do the equivalent
260		 * of:
261		 * *(u32 *)(stack_tmp_stride + (u32)&stack_tmp_stride_rel)
262		 */
263		adr	r3, stack_tmp_stride_rel
264		ldr	r1, [r3]
265		ldr	r1, [r1, r3]
266
267		/*
268		 * r0 is core pos + 1
269		 * r1 is value of stack_tmp_stride
270		 * r2 is value of stack_tmp + guard
271		 */
272		mul	r1, r0, r1
273		add	sp, r1, r2
274	.endm
275
276	/*
277	 * Cache maintenance during entry: handle outer cache.
278	 * End address is exclusive: first byte not to be changed.
279	 * Note however arm_clX_inv/cleanbyva operate on full cache lines.
280	 *
281	 * Use ANSI #define to trap source file line number for PL310 assertion
282	 */
283	.macro __inval_cache_vrange vbase, vend, line
284#if defined(CFG_PL310) && !defined(CFG_PL310_SIP_PROTOCOL)
285		assert_flat_mapped_range (\vbase), (\line)
286		bl	pl310_base
287		ldr	r1, \vbase
288		ldr	r2, =\vend
289		ldr	r2, [r2]
290		bl	arm_cl2_invbypa
291#endif
292		ldr	r0, \vbase
293		ldr	r1, =\vend
294		ldr	r1, [r1]
295		sub	r1, r1, r0
296		bl	dcache_inv_range
297	.endm
298
299	.macro __flush_cache_vrange vbase, vend, line
300#if defined(CFG_PL310) && !defined(CFG_PL310_SIP_PROTOCOL)
301		assert_flat_mapped_range (\vbase), (\line)
302		ldr	r0, \vbase
303		ldr	r1, =\vend
304		ldr	r1, [r1]
305		sub	r1, r1, r0
306		bl	dcache_clean_range
307		bl	pl310_base
308		ldr	r1, \vbase
309		ldr	r2, =\vend
310		ldr	r2, [r2]
311		bl	arm_cl2_cleaninvbypa
312#endif
313		ldr	r0, \vbase
314		ldr	r1, =\vend
315		ldr	r1, [r1]
316		sub	r1, r1, r0
317		bl	dcache_cleaninv_range
318	.endm
319
320#define inval_cache_vrange(vbase, vend) \
321		__inval_cache_vrange vbase, vend, __LINE__
322
323#define flush_cache_vrange(vbase, vend) \
324		__flush_cache_vrange vbase, vend, __LINE__
325
326#ifdef CFG_BOOT_SYNC_CPU
327#define flush_cpu_semaphores \
328		flush_cache_vrange(sem_cpu_sync_start, sem_cpu_sync_end)
329#else
330#define flush_cpu_semaphores
331#endif
332
333LOCAL_FUNC reset_primary , : , .identity_map
334UNWIND(	.cantunwind)
335
336	/* preserve r4-r8: bootargs */
337
338#ifdef CFG_WITH_PAGER
339	/*
340	 * Move init code into correct location and move hashes to a
341	 * temporary safe location until the heap is initialized.
342	 *
343	 * The binary is built as:
344	 * [Pager code, rodata and data] : In correct location
345	 * [Init code and rodata] : Should be copied to __init_start
346	 * [struct boot_embdata + data] : Should be saved before
347	 * initializing pager, first uint32_t tells the length of the data
348	 */
349	ldr	r0, =__init_start	/* dst */
350	ldr	r1, =__data_end 	/* src */
351	ldr	r2, =__init_end
352	sub	r2, r2, r0		/* init len */
353	ldr	r12, [r1, r2]		/* length of hashes etc */
354	add	r2, r2, r12		/* length of init and hashes etc */
355	/* Copy backwards (as memmove) in case we're overlapping */
356	add	r0, r0, r2		/* __init_start + len */
357	add	r1, r1, r2		/* __data_end + len */
358	ldr	r3, =boot_cached_mem_end
359	str	r0, [r3]
360	ldr	r2, =__init_start
361copy_init:
362	ldmdb	r1!, {r3, r9-r12}
363	stmdb	r0!, {r3, r9-r12}
364	cmp	r0, r2
365	bgt	copy_init
366#else
367	/*
368	 * The binary is built as:
369	 * [Core, rodata and data] : In correct location
370	 * [struct boot_embdata + data] : Should be moved to right before
371	 * __vcore_free_end, the first uint32_t tells the length of the
372	 * struct + data
373	 */
374	ldr	r1, =__data_end		/* src */
375	ldr	r2, [r1]		/* struct boot_embdata::total_len */
376	/* dst */
377	ldr	r0, =__vcore_free_end
378	sub	r0, r0, r2
379	/* round down to beginning of page */
380	mov	r3,  #(SMALL_PAGE_SIZE - 1)
381	bic	r0, r0, r3
382	ldr	r3, =boot_embdata_ptr
383	str	r0, [r3]
384	/* Copy backwards (as memmove) in case we're overlapping */
385	add	r1, r1, r2
386	add	r2, r0, r2
387	ldr	r3, =boot_cached_mem_end
388	str	r2, [r3]
389
390copy_init:
391	ldmdb	r1!, {r3, r9-r12}
392	stmdb	r2!, {r3, r9-r12}
393	cmp	r2, r0
394	bgt	copy_init
395#endif
396
397	/*
398	 * Clear .bss, this code obviously depends on the linker keeping
399	 * start/end of .bss at least 8 byte aligned.
400	 */
401	ldr	r0, =__bss_start
402	ldr	r1, =__bss_end
403	mov	r2, #0
404	mov	r3, #0
405clear_bss:
406	stmia	r0!, {r2, r3}
407	cmp	r0, r1
408	bls	clear_bss
409
410#ifdef CFG_NS_VIRTUALIZATION
411	/*
412	 * Clear .nex_bss, this code obviously depends on the linker keeping
413	 * start/end of .bss at least 8 byte aligned.
414	 */
415	ldr	r0, =__nex_bss_start
416	ldr	r1, =__nex_bss_end
417	mov	r2, #0
418	mov	r3, #0
419clear_nex_bss:
420	stmia	r0!, {r2, r3}
421	cmp	r0, r1
422	bls	clear_nex_bss
423#endif
424
425#ifdef CFG_CORE_SANITIZE_KADDRESS
426	/* First initialize the entire shadow area with no access */
427	ldr	r0, =__asan_shadow_start	/* start */
428	ldr	r1, =__asan_shadow_end	/* limit */
429	mov	r2, #ASAN_DATA_RED_ZONE
430shadow_no_access:
431	str	r2, [r0], #4
432	cmp	r0, r1
433	bls	shadow_no_access
434
435	/* Mark the entire stack area as OK */
436	ldr	r2, =CFG_ASAN_SHADOW_OFFSET
437	ldr	r0, =__nozi_stack_start	/* start */
438	lsr	r0, r0, #ASAN_BLOCK_SHIFT
439	add	r0, r0, r2
440	ldr	r1, =__nozi_stack_end	/* limit */
441	lsr	r1, r1, #ASAN_BLOCK_SHIFT
442	add	r1, r1, r2
443	mov	r2, #0
444shadow_stack_access_ok:
445	strb	r2, [r0], #1
446	cmp	r0, r1
447	bls	shadow_stack_access_ok
448#endif
449
450	set_sp
451
452	/* Initialize thread_core_local[current_cpu_id] for early boot */
453	bl	thread_get_core_local
454	push	{r0,r1}
455	bl	thread_get_abt_stack
456	pop	{r1,r2}
457	mov	r3, sp
458
459	cps	#CPSR_MODE_IRQ
460	mov	sp, r3
461	cps	#CPSR_MODE_FIQ
462	mov	sp, r3
463	cps	#CPSR_MODE_ABT
464	mov	sp, r1
465	cps	#CPSR_MODE_UND
466	mov	sp, r1
467	cps	#CPSR_MODE_SVC
468
469	str	sp, [r1, #THREAD_CORE_LOCAL_TMP_STACK_VA_END]
470	str	r0, [r1, #THREAD_CORE_LOCAL_ABT_STACK_VA_END]
471	mov	r0, #THREAD_ID_INVALID
472	str	r0, [r1, #THREAD_CORE_LOCAL_CURR_THREAD]
473	mov	r0, #THREAD_CLF_TMP
474	str	r0, [r1, #THREAD_CORE_LOCAL_FLAGS]
475
476	/* complete ARM secure MP common configuration */
477	bl	plat_primary_init_early
478
479	/* Enable Console */
480	bl	console_init
481
482	mov	r0, r8
483	mov	r1, #0
484	push	{r0, r1}
485	mov	r0, r4
486	mov	r1, r5
487	mov	r2, r6
488	mov	r3, r7
489	bl	boot_save_args
490	add	sp, sp, #(2 * 4)
491
492#ifdef CFG_WITH_PAGER
493	ldr	r0, =__init_end	/* pointer to boot_embdata */
494	ldr	r1, [r0]	/* struct boot_embdata::total_len */
495	add	r0, r0, r1
496	mov_imm	r1, 0xfff
497	add	r0, r0, r1	/* round up */
498	bic	r0, r0, r1	/* to next page */
499	mov_imm r1, (TEE_RAM_PH_SIZE + TEE_RAM_START)
500	mov	r2, r1
501#else
502	ldr	r0, =__vcore_free_start
503	ldr	r1, =boot_embdata_ptr
504	ldr	r1, [r1]
505	ldr	r2, =__vcore_free_end
506#endif
507	bl	boot_mem_init
508
509#ifdef CFG_PL310
510	bl	pl310_base
511	bl	arm_cl2_config
512#endif
513
514	/*
515	 * Invalidate dcache for all memory used during initialization to
516	 * avoid nasty surprices when the cache is turned on. We must not
517	 * invalidate memory not used by OP-TEE since we may invalidate
518	 * entries used by for instance ARM Trusted Firmware.
519	 */
520	inval_cache_vrange(cached_mem_start, boot_cached_mem_end)
521
522#if defined(CFG_PL310) && !defined(CFG_PL310_SIP_PROTOCOL)
523	/* Enable PL310 if not yet enabled */
524	bl	pl310_base
525	bl	arm_cl2_enable
526#endif
527
528#ifdef CFG_CORE_ASLR
529	bl	get_aslr_seed
530#ifdef CFG_CORE_ASLR_SEED
531	mov_imm	r0, CFG_CORE_ASLR_SEED
532#endif
533#else
534	mov	r0, #0
535#endif
536
537	ldr	r1, =boot_mmu_config
538	bl	core_init_mmu_map
539
540#ifdef CFG_CORE_ASLR
541	/*
542	 * Save a pointer to thread_core_local[core_pos] since we can't
543	 * call thread_get_core_local() again before the recorded end_va's
544	 * have been updated below.
545	 */
546	bl	thread_get_core_local
547	mov	r4, r0
548
549	/*
550	 * Process relocation information for updating with the virtual map
551	 * offset.  We're doing this now before MMU is enabled as some of
552	 * the memory will become write protected.
553	 */
554	ldr	r0, =boot_mmu_config
555	ldr	r0, [r0, #CORE_MMU_CONFIG_MAP_OFFSET]
556	/*
557	 * Update boot_cached_mem_end address with load offset since it was
558	 * calculated before relocation.
559	 */
560	ldr	r3, =boot_cached_mem_end
561	ldr	r2, [r3]
562	add	r2, r2, r0
563	str	r2, [r3]
564
565	bl	relocate
566#endif
567
568	bl	__get_core_pos
569	bl	enable_mmu
570#ifdef CFG_CORE_ASLR
571	/*
572	 * Update recorded end_va, we depend on r4 pointing to the
573	 * pre-relocated thread_core_local[core_pos].
574	 *
575	 * This must be done before calling into C code to make sure that
576	 * the stack pointer matches what we have in thread_core_local[].
577	 */
578	ldr	r1, =boot_mmu_config
579	ldr	r1, [r1, #CORE_MMU_CONFIG_MAP_OFFSET]
580	add	r4, r4, r1
581	ldr	r0, [r4, #THREAD_CORE_LOCAL_ABT_STACK_VA_END]
582	add	r0, r0, r1
583	str	r0, [r4, #THREAD_CORE_LOCAL_ABT_STACK_VA_END]
584	ldr	r0, [r4, #THREAD_CORE_LOCAL_TMP_STACK_VA_END]
585	add	r0, r0, r1
586	str	r0, [r4, #THREAD_CORE_LOCAL_TMP_STACK_VA_END]
587
588	cps	#CPSR_MODE_IRQ
589	mov	sp, r0
590	cps	#CPSR_MODE_FIQ
591	mov	sp, r0
592	cps	#CPSR_MODE_ABT
593	mov	sp, r4
594	cps	#CPSR_MODE_UND
595	mov	sp, r4
596	cps	#CPSR_MODE_SVC
597
598	/* Update relocations recorded with boot_mem_add_reloc() */
599	ldr	r0, =boot_mmu_config
600	ldr	r0, [r0, #CORE_MMU_CONFIG_MAP_OFFSET]
601	bl	boot_mem_relocate
602	/*
603	 * Reinitialize console, since register_serial_console() has
604	 * previously registered a PA and with ASLR the VA is different
605	 * from the PA.
606	 */
607	bl	console_init
608#endif
609
610#ifdef CFG_NS_VIRTUALIZATION
611	/*
612	 * Initialize partition tables for each partition to
613	 * default_partition which has been relocated now to a different VA
614	 */
615	bl	core_mmu_set_default_prtn_tbl
616#endif
617
618	bl	boot_init_primary_early
619	bl	boot_init_primary_late
620#ifndef CFG_NS_VIRTUALIZATION
621	mov	r9, sp
622	ldr	r0, =threads
623	ldr	r0, [r0, #THREAD_CTX_STACK_VA_END]
624	mov	sp, r0
625	bl	thread_get_core_local
626	mov	r8, r0
627	mov	r0, #0
628	str	r0, [r8, #THREAD_CORE_LOCAL_FLAGS]
629#endif
630	bl	boot_init_primary_runtime
631	bl	boot_init_primary_final
632#ifndef CFG_NS_VIRTUALIZATION
633	mov	r0, #THREAD_CLF_TMP
634	str	r0, [r8, #THREAD_CORE_LOCAL_FLAGS]
635	mov	sp, r9
636#endif
637
638#ifdef _CFG_CORE_STACK_PROTECTOR
639	/* Update stack canary value */
640	sub	sp, sp, #0x8
641	mov	r0, sp
642	mov	r1, #1
643	mov	r2, #0x4
644	bl	plat_get_random_stack_canaries
645	ldr	r0, [sp]
646	ldr	r1, =__stack_chk_guard
647	str	r0, [r1]
648	add	sp, sp, #0x8
649#endif
650
651	/*
652	 * In case we've touched memory that secondary CPUs will use before
653	 * they have turned on their D-cache, clean and invalidate the
654	 * D-cache before exiting to normal world.
655	 */
656	flush_cache_vrange(cached_mem_start, boot_cached_mem_end)
657
658	/* release secondary boot cores and sync with them */
659	cpu_is_ready
660	flush_cpu_semaphores
661	wait_secondary
662
663#ifdef CFG_PL310_LOCKED
664#ifdef CFG_PL310_SIP_PROTOCOL
665#error "CFG_PL310_LOCKED must not be defined when CFG_PL310_SIP_PROTOCOL=y"
666#endif
667	/* lock/invalidate all lines: pl310 behaves as if disable */
668	bl	pl310_base
669	bl	arm_cl2_lockallways
670	bl	pl310_base
671	bl	arm_cl2_cleaninvbyway
672#endif
673
674	/*
675	 * Clear current thread id now to allow the thread to be reused on
676	 * next entry. Matches the thread_init_boot_thread() in
677	 * boot.c.
678	 */
679#ifndef CFG_NS_VIRTUALIZATION
680	bl 	thread_clr_boot_thread
681#endif
682
683#ifdef CFG_CORE_FFA
684	ldr	r0, =cpu_on_handler
685	/*
686	 * Compensate for the virtual map offset since cpu_on_handler() is
687	 * called with MMU off.
688	 */
689	ldr	r1, boot_mmu_config + CORE_MMU_CONFIG_MAP_OFFSET
690	sub	r0, r0, r1
691	bl	thread_spmc_register_secondary_ep
692	b	thread_ffa_msg_wait
693#else /* CFG_CORE_FFA */
694
695#if defined(CFG_WITH_ARM_TRUSTED_FW)
696	ldr	r0, =boot_mmu_config
697	ldr	r0, [r0, #CORE_MMU_CONFIG_MAP_OFFSET]
698	ldr	r1, =thread_vector_table
699	/* Pass the vector address returned from main_init */
700	sub	r1, r1, r0
701#else
702	/* Initialize secure monitor */
703	add	r0, sp, #__STACK_TMP_OFFS
704	bl	sm_init
705	ldr	r0, =boot_arg_nsec_entry
706	ldr	r0, [r0]
707	bl	init_sec_mon
708
709	/* Relay standard bootarg #1 and #2 to non-secure entry */
710	mov	r4, #0
711	mov	r3, r6		/* std bootarg #2 for register R2 */
712	mov	r2, r5		/* std bootarg #1 for register R1 */
713	mov	r1, #0
714#endif /* CFG_WITH_ARM_TRUSTED_FW */
715
716	mov	r0, #TEESMC_OPTEED_RETURN_ENTRY_DONE
717	smc	#0
718	/* SMC should not return */
719	panic_at_smc_return
720#endif /* CFG_CORE_FFA */
721END_FUNC reset_primary
722
723#ifdef CFG_BOOT_SYNC_CPU
724LOCAL_DATA sem_cpu_sync_start , :
725	.word	sem_cpu_sync
726END_DATA sem_cpu_sync_start
727
728LOCAL_DATA sem_cpu_sync_end , :
729	.word	sem_cpu_sync + (CFG_TEE_CORE_NB_CORE << 2)
730END_DATA sem_cpu_sync_end
731#endif
732
733LOCAL_DATA cached_mem_start , :
734	.word	__text_start
735END_DATA cached_mem_start
736
737#ifndef CFG_WITH_PAGER
738LOCAL_DATA boot_embdata_ptr , :
739	.skip	4
740END_DATA boot_embdata_ptr
741#endif
742
743LOCAL_FUNC unhandled_cpu , :
744	wfi
745	b	unhandled_cpu
746END_FUNC unhandled_cpu
747
748#ifdef CFG_CORE_ASLR
749LOCAL_FUNC relocate , :
750	push	{r4-r5}
751	/* r0 holds load offset */
752#ifdef CFG_WITH_PAGER
753	ldr	r12, =__init_end
754#else
755	ldr	r12, =boot_embdata_ptr
756	ldr	r12, [r12]
757#endif
758	ldr	r2, [r12, #BOOT_EMBDATA_RELOC_OFFSET]
759	ldr	r3, [r12, #BOOT_EMBDATA_RELOC_LEN]
760
761	mov_imm	r1, TEE_LOAD_ADDR
762	add	r2, r2, r12	/* start of relocations */
763	add	r3, r3, r2	/* end of relocations */
764
765	/*
766	 * Relocations are not formatted as Rel32, instead they are in a
767	 * compressed format created by get_reloc_bin() in
768	 * scripts/gen_tee_bin.py
769	 *
770	 * All the R_ARM_RELATIVE relocations are translated into a list of
771	 * 32-bit offsets from TEE_LOAD_ADDR. At each address a 32-bit
772	 * value pointed out which increased with the load offset.
773	 */
774
775#ifdef CFG_WITH_PAGER
776	/*
777	 * With pager enabled we can only relocate the pager and init
778	 * parts, the rest has to be done when a page is populated.
779	 */
780	sub	r12, r12, r1
781#endif
782
783	b	2f
784	/* Loop over the relocation addresses and process all entries */
7851:	ldr	r4, [r2], #4
786#ifdef CFG_WITH_PAGER
787	/* Skip too large addresses */
788	cmp	r4, r12
789	bge	2f
790#endif
791	ldr	r5, [r4, r1]
792	add	r5, r5, r0
793	str	r5, [r4, r1]
794
7952:	cmp	r2, r3
796	bne	1b
797
798	pop	{r4-r5}
799	bx	lr
800END_FUNC relocate
801#endif
802
803/*
804 * void enable_mmu(unsigned long core_pos);
805 *
806 * This function depends on being mapped with in the identity map where
807 * physical address and virtual address is the same. After MMU has been
808 * enabled the instruction pointer will be updated to execute as the new
809 * offset instead. Stack pointers and the return address are updated.
810 */
811LOCAL_FUNC enable_mmu , : , .identity_map
812	/* r0 = core pos */
813	adr	r1, boot_mmu_config
814
815#ifdef CFG_WITH_LPAE
816	ldm	r1!, {r2, r3}
817	/*
818	 * r2 = ttbcr
819	 * r3 = mair0
820	 */
821	write_ttbcr r2
822	write_mair0 r3
823
824	ldm	r1!, {r2, r3}
825	/*
826	 * r2 = ttbr0_base
827	 * r3 = ttbr0_core_offset
828	 */
829
830	/*
831	 * ttbr0_el1 = ttbr0_base + ttbr0_core_offset * core_pos
832	 */
833	mla	r12, r0, r3, r2
834	mov	r0, #0
835	write_ttbr0_64bit r12, r0
836	write_ttbr1_64bit r0, r0
837#else
838	ldm	r1!, {r2, r3}
839	/*
840	 * r2 = prrr
841	 * r3 = nmrr
842	 */
843	write_prrr r2
844	write_nmrr r3
845
846	ldm	r1!, {r2, r3}
847	/*
848	 * r2 = dacr
849	 * r3 = ttbcr
850	 */
851	write_dacr r2
852	write_ttbcr r3
853
854	ldm	r1!, {r2}
855	/* r2 = ttbr */
856	write_ttbr0 r2
857	write_ttbr1 r2
858
859	mov	r2, #0
860	write_contextidr r2
861#endif
862	ldm	r1!, {r2}
863	/* r2 = load_offset (always 0 if CFG_CORE_ASLR=n) */
864	isb
865
866	/* Invalidate TLB */
867	write_tlbiall
868
869	/*
870	 * Make sure translation table writes have drained into memory and
871	 * the TLB invalidation is complete.
872	 */
873	dsb	sy
874	isb
875
876	read_sctlr r0
877	orr	r0, r0, #SCTLR_M
878#ifndef CFG_WITH_LPAE
879	/* Enable Access flag (simplified access permissions) and TEX remap */
880	orr	r0, r0, #(SCTLR_AFE | SCTLR_TRE)
881#endif
882	write_sctlr r0
883	isb
884
885	/* Update vbar */
886	read_vbar r1
887	add	r1, r1, r2
888	write_vbar r1
889	isb
890
891	/* Invalidate instruction cache and branch predictor */
892	write_iciallu
893	write_bpiall
894	isb
895
896	read_sctlr r0
897	/* Enable I and D cache */
898	orr	r0, r0, #SCTLR_I
899	orr	r0, r0, #SCTLR_C
900#if defined(CFG_ENABLE_SCTLR_Z)
901	/*
902	 * This is only needed on ARMv7 architecture and hence conditionned
903	 * by configuration directive CFG_ENABLE_SCTLR_Z. For recent
904	 * architectures, the program flow prediction is automatically
905	 * enabled upon MMU enablement.
906	 */
907	orr	r0, r0, #SCTLR_Z
908#endif
909	write_sctlr r0
910	isb
911
912	/* Adjust stack pointer and return address */
913	add	sp, sp, r2
914	add	lr, lr, r2
915
916	bx	lr
917END_FUNC enable_mmu
918
919LOCAL_DATA stack_tmp_rel , :
920	.word	stack_tmp - stack_tmp_rel - STACK_TMP_GUARD
921END_DATA stack_tmp_rel
922
923LOCAL_DATA stack_tmp_stride_rel , :
924	.word	stack_tmp_stride - stack_tmp_stride_rel
925END_DATA stack_tmp_stride_rel
926
927DATA boot_mmu_config , : /* struct core_mmu_config */
928	.skip	CORE_MMU_CONFIG_SIZE
929END_DATA boot_mmu_config
930
931#if defined(CFG_WITH_ARM_TRUSTED_FW)
932FUNC cpu_on_handler , : , .identity_map
933UNWIND(	.cantunwind)
934	mov	r4, r0
935	mov	r5, r1
936	mov	r6, lr
937
938	set_sctlr
939	isb
940
941	ldr	r0, =reset_vect_table
942	write_vbar r0
943
944	mov	r4, lr
945
946	bl	__get_core_pos
947	bl	enable_mmu
948
949	set_sp
950
951	mov	r0, r4
952	mov	r1, r5
953	bl	boot_cpu_on_handler
954#ifdef CFG_CORE_FFA
955	b	thread_ffa_msg_wait
956#else
957	bx	r6
958#endif
959END_FUNC cpu_on_handler
960DECLARE_KEEP_PAGER cpu_on_handler
961
962#else /* defined(CFG_WITH_ARM_TRUSTED_FW) */
963
964LOCAL_FUNC reset_secondary , : , .identity_map
965UNWIND(	.cantunwind)
966	ldr	r0, =reset_vect_table
967	write_vbar r0
968
969	wait_primary
970
971	set_sp
972
973#if defined (CFG_BOOT_SECONDARY_REQUEST)
974	/* if L1 is not invalidated before, do it here */
975	mov	r0, #DCACHE_OP_INV
976	bl	dcache_op_level1
977#endif
978
979	bl	__get_core_pos
980	bl	enable_mmu
981
982	cpu_is_ready
983
984#if defined (CFG_BOOT_SECONDARY_REQUEST)
985	/*
986	 * boot_core_hpen() return value (r0) is address of
987	 * ns entry context structure
988	 */
989	bl	boot_core_hpen
990	ldm	r0, {r0, r6}
991	mov	r8, r0
992#else
993	mov	r6, #0
994#endif
995	bl	boot_init_secondary
996
997	/* Initialize secure monitor */
998	add	r0, sp, #__STACK_TMP_OFFS
999	bl	sm_init
1000	mov	r0, r8		/* ns-entry address */
1001	bl	init_sec_mon
1002
1003	mov	r0, #TEESMC_OPTEED_RETURN_ENTRY_DONE
1004	mov	r1, r6
1005	mov	r2, #0
1006	mov	r3, #0
1007	mov	r4, #0
1008	smc	#0
1009	/* SMC should not return */
1010	panic_at_smc_return
1011END_FUNC reset_secondary
1012DECLARE_KEEP_PAGER reset_secondary
1013#endif /* defined(CFG_WITH_ARM_TRUSTED_FW) */
1014